Model Notices of Privacy Practices

The Office of the National Coordinator for Health Information Technology (ONC) and the Office for Civil Rights (OCR) collaborated to develop model Notices of Privacy Practices for health care providers and health plans for use when communicating with their patients and plan members. The model notices are available for presentation to patients in paper and electronic form. For example, after customization, a user can print and distribute (paper-based notice) or post/display the notice on the user’s website (digital notice).

Paper-based Model Notices

Developed with input from consumers and key stakeholders, these paper-based model notices are provided in three different styles and are customizable by users. Health care providers and health plans may use these models by entering some of their information into the model, such as contact information, and then printing for distribution and making them available for download on their websites.

The three options are:

Notice in the form of a booklet

A layered notice with a summary of the information on the first page and full content on the following pages

A notice with the design elements of the booklet, but that is formatted for full-page presentation

Additionally, a text-only version is available for health care providers and health plans who wish only to use the content and not the overall format/layout of the model notice.

The HIPAA Privacy Rule gives patients a right to be informed of the privacy practices of health care providers and health plans as well as patients’ privacy rights regarding their personal health information. Health care providers and health plans that are subject to HIPAA are required to develop and distribute a notice that provides a clear, user-friendly explanation of these rights and practices.

These model notices can help providers and plans by

reflecting the 2013 regulatory changes to the HIPAA Privacy and Security Rules

serving as the baseline for covered health providers and plans working to come into compliance with the new requirements